3 commits

Author	SHA1	Message	Date
Grovy311	e51752f3e1	docs(security): Design-Entscheidung D1 (Projekte teamweit geteilt) eintragen ... Julian hat am 17.10.2026 bestaetigt: die Software laeuft nur im eigenen Team, alle Nutzer sehen alle Projekte. Bevor Externe Konten bekommen, wird Besitz/Freigabe pro Projekt eingefuehrt. R3 (ASVS-light B1/B2) damit nicht anwendbar; idorGap-Kommentar und AGENTS.md verweisen auf D1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-17 12:56:23 +02:00
Grovy311	1cf406d216	docs(security): Threat-Model anlegen, Entscheidung zu geteilten Projekten offen ... docs/THREATMODEL.md (threat-model-light): System, Assets, Angreifer, Vertrauensgrenzen, Risiken R1-R14 mit Beleg. R3 (ASVS-light B1/B2) bleibt offen, bis Julian E1 (Projekte teamweit geteilt) bestaetigt. idorGap- Kommentar und AGENTS.md verweisen darauf. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-17 12:40:43 +02:00
Grovy311	a7a1595cbf	Add test and security baseline ... - make quick/check/mutation from cj/security-baseline (Makefile unchanged, settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint security rules, Forgejo workflow - tests/security: generic baseline tests plus app config and role tests against createApp() with an in-memory database - extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests - fix gaps found by the tests: reject unknown fields on project create, answer malformed JSON with 400 instead of 500, set nosniff on the API - npm audit fix (next 16.4.1 and others, no high/critical left) - clear ESLint errors, safeFileName without control-character regex - per-project ownership stays an open, documented gap (idorGap -> TODO) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 09:40:33 +02:00